What Six Fingerprint Checkers Actually Catch (Tested With a Modified Firefox)

Every fingerprint-checking site promises to tell you how identifiable your browser is. But do they agree with each other? To find out, I ran the same browser through six of them back to back and compared the verdicts. The browser was Camoufox, an open-source Firefox fork that spoofs fingerprint surfaces, on a fixed profile with a direct (no proxy) connection. Every result page was dumped to text so the verdicts could be compared offline.

The consistency checkers came back clean. SannySoft's scanner passed all 20 of its table checks (user agent, languages, ETSL and friends). IPHey returned an identity verdict of Trustworthy with an MX score of 100. These two sites are looking for internal contradictions: does your declared UA match the APIs behind it. A coherent spoof passes them by design.

CreepJS, the most academic of the six, also came back clean: 0% headless, 0% stealth, 13% "like headless" - which is the same baseline noise a stock headed browser shows. The interesting part is what those numbers mean. CreepJS detects automation traces: CDP artifacts, stealth-plugin patches, driver-level tells. It does not attempt to judge whether your user agent string is honest. A modified browser with no automation framework attached is, in CreepJS's frame of reference, simply a browser.

BrowserLeaks surfaced the most genuinely surprising finding of the run. On Linux, a stock Firefox exposes the host's speech-dispatcher voices through speechSynthesis.getVoices() - 131 entries with urn:moz-tts:speechd URIs in this capture. That list leaks which TTS engines and language packs are installed on the machine behind the browser: a fingerprint surface and an environment leak at once, and one that almost nobody talks about. The fix is a preference, not a script: set media.webspeech.synth.enabled to false in about:config. JS-level monkey-patching does not help because the enumeration happens in native code before your script can intercept it. After the preference change, the same check returns zero voices.

AMIUnique reports that you are unique among its 5.69 million collected fingerprints. That sounds alarming and is neither surprising nor avoidable: the combination of canvas, fonts, and WebGL rendering is essentially unique for everyone. The realistic goal of a hardened browser is not to be ununique - it is to be unattributable, meaning the identity does not link back to your other sessions. PixelScan was the odd one out in two ways. First, its 2026 homepage no longer renders results on load; you have to click "Scan My Browser Now", which quietly breaks any automated tester that only waits for the page. Second, it flagged "Masking detected" - yet an unmodified stock Chromium run through the same flow gets the same flag. Its declared-versus-rendered consistency checks appear to be simply harsh on anything that is not Chrome.

Put the six verdicts side by side and the only yellow flag comes from the one site whose own reference browser also trips it, while the strictest academic checker scores the spoof clean. That is not a contradiction - it is a reminder that "detection" means something different at each site. CreepJS asks "is there automation machinery". SannySoft and IPHey ask "is the story internally consistent". PixelScan asks "does this look like stock Chrome". A browser can honestly earn different answers to all three.

If you test browsers against checker sites, four things from this run generalize:

• speechSynthesis voice enumeration is an overlooked leak surface, especially on Linux; check it with a preference, not a script.
• PixelScan requires a click before it produces anything; a "loaded the page" assertion is a false pass.
• Report which dimension each site actually measures, not just pass/fail - cross-site verdicts legitimately disagree.
• Being "unique" is the normal state of every browser. Being "inconsistent" is the one that gets you flagged.